PHP's openssl_sign generates different signature than SSCrypto's sign

Question

I'm writing an OS X client for a software that is written in PHP. This software uses a simple RPC interface to receive and execute commands. The RPC client has to sign the commands he sends to ensure that no MITM can modify any of them.

However, as the server was not accepting the signatures I sent from my OS X client, I started investigating and found out that PHP's openssl_sign function generates a different signature for a given private key/data combination than the Objective-C SSCrypto framework (which is only a wrapper for the openssl lib):

SSCrypto *crypto = [[SSCrypto alloc] initWithPrivateKey:self.localPrivKey];
NSData *shaed = [self sha1:@"hello"];
[crypto setClearTextWithData:shaed];
NSData *data = [crypto sign];

generates a signature like CtbkSxvqNZ+mAN...

The PHP code

openssl_sign("hello", $signature, $privateKey);

generates a signature like 6u0d2qjFiMbZ+... (For my certain key, of course. base64 encoded)

I'm not quite shure why this is happening and I unsuccessfully experimented with different hash-algorithms. As the PHP documentation states SHA1 is used by default.

So why do these two functions generate different signatures and how can I get my Objective-C part to generate a signature that PHPs openssl_verify will accept?

Note: I double checked that the keys and the data is correct!

score 9 · Accepted Answer · 2013-03-25T18:35:51.583

9

Okay, it took quite a few hours. Here's what's happening:

When you call the openssl_sign function, PHP internally uses the EVP API that is provided by the openssl lib. EVP is a "high level" API to the underlying functions like RSA_private_encrypt. So when you call base64_encode(openssl_sign('hello', $signature, $privKey)) that's similar to do something like this on the command line using the openssl binary:

echo -n "hello"| openssl dgst -sha1 -sign priv.key | openssl enc -base64

and NOT

echo -n "hello" | openssl dgst -sha1 | openssl rsautl -encrypt priv.key | openssl enc -base64

I don't know why this produces different output , but it does. If someone has an idea why they differ: please share!
However, as I'm using the SSCrypto framework I rewrote the -sign (and -verify) function with EVP calls (abstract):

OpenSSL_add_all_digests();
EVP_MD_CTX_init(&md_ctx);
EVP_SignInit(&md_ctx, mdtype);
EVP_SignUpdate(&md_ctx, input, inlen);
if (EVP_SignFinal(&md_ctx, (unsigned char*) outbuf, (unsigned int *)&outlen, pkey)) {
    NSLog(@"signed successfully.");
}

And voila: I get the same signatures as I got from PHP. Oh and for the record: PHP uses the PKCS padding.

Thank you guys for pointing me in the right direction!

edited Mar 25 '13 at 18:35

answered Apr 24 '10 at 23:56

This worked for me --but I also had to call OpenSSL_add_all_digests() prior to initializing the EVP context. – CJJ Mar 25 '13 at 18:30
`openssl_sign()` returns a boolean value true for sucess false for failure), not the signature, so `base64_encode(openssl_sign('hello', $signature, $privKey))` would only encode that boolean. – MrGlass Apr 16 '13 at 18:05
Yes, that's more like pseudo-code. Additionally (regarding the openssl examples), at the time I wrote this, I did non realize that signing was not exactly the same as encrypting with the private key. Signing only encrypts a hash of the data instead of the data itself. – Apr 17 '13 at 08:35
That's because technically speaking, signing returns a different byte format than encrypting with the private key (see RFC 2315, PKCS #7). See this answer, which is related to your question: http://stackoverflow.com/a/10999044/92517 . Note, this is not limited to PHP. – jmibanez Jul 05 '13 at 08:33

score 2 · Answer 2 · answered Nov 22 '11 at 10:54

Your code snippet was a big help, I had the same problem, and I came up with the following method based on your lines, if that helps anyone with the same issue.

- (NSData *)getSignature {
NSString * signString = [self getSignatureText];
NSData * privateKeyData = [self getPrivateKey];

BIO *publicBIO = NULL;
EVP_PKEY *privateKey = NULL;

if (!(publicBIO = BIO_new_mem_buf((unsigned char *)[privateKeyData bytes], [privateKeyData length]))) {
    NSLog(@"BIO_new_mem_buf() failed!");
    return nil;
}

if (!PEM_read_bio_PrivateKey(publicBIO, &privateKey, NULL, NULL)) {
    NSLog(@"PEM_read_bio_PrivateKey() failed!");
    return nil;
}   

const char * data = [signString cStringUsingEncoding:NSUTF8StringEncoding];
unsigned int length = [signString length];
int outlen;
unsigned char * outbuf[EVP_MAX_MD_SIZE];
const EVP_MD * digest = EVP_md5();
EVP_MD_CTX md_ctx;

EVP_MD_CTX_init(&md_ctx);
EVP_SignInit(&md_ctx, digest);
EVP_SignUpdate(&md_ctx, data, length);
if (EVP_SignFinal(&md_ctx, (unsigned char*) outbuf, (unsigned int *) &outlen, privateKey)) {
    NSLog(@"Signed successfully.");
}
EVP_MD_CTX_cleanup(&md_ctx);
EVP_PKEY_free(privateKey);

NSData * signature = [NSData dataWithBytes:outbuf length:outlen];

return signature;

}

score 0 · Answer 3 · answered Apr 23 '10 at 23:35

0

It looks to me like your PHP is signing "hello", while your Objective-C is signing sha1("hello"). That is, the way I read the docs, PHP's openssl_sign is using sha1 by default in the internal mechanics of signing, as opposed to applying sha1 to the data before signing.

answered Apr 23 '10 at 23:35

Isaac

10,668
5
59
68

I removed the sha1 in my Objective-C code but I still get a different (third) signature: `iaQ+f1PJi`... Note: The signatures that are generated with SSCrypto (Objective-C) match with the ones I can generate using openssl directly on the command line. – Apr 24 '10 at 00:00
Does `openssl_verify()` still fail on the new signature? Also (based on the sample code with `SSCrypto`) are you using something like `[signedData encodeBase64]`? – Isaac Apr 24 '10 at 00:18
Yes, PHP's `openssl_verify()` still fails (returns 0). I only use `[signedData encodeBase64]` for the human readable output (e.g. `NSLog()`), anywhere else I use `NSData` or `NSString`. I think the problem is on the PHP side as SSCrypto generates valid signatures that work with the normal openssl binary. – Apr 24 '10 at 00:47
If either side is doing some padding on the string, they may be padding with different characters and thereby throwing off the hash. You could try trivially extending the string length one character at a time and see if they match at some point, which'd be your block size. – Marc B Apr 24 '10 at 02:22

score 0 · Answer 4 · answered Jul 31 '10 at 11:42

0

Not that it fixes, but your use of rsautl seems to be incorrect. You probably should be using rsautl -sign instead of rsautl -encrypt

answered Jul 31 '10 at 11:42

Nat Sakimura

943
7
6

PHP's openssl_sign generates different signature than SSCrypto's sign

4 Answers4

Linked